40b6128bca00db48260f846f37bc57498f2dfe7b3c3a3aa3fed032000d62d639

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 01:45

Target

27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe
Size

10.9MB
MD5

c83563592581c4544e7ed495cb17dda5
SHA1

d9e8278c0ca87bb136b3c4f73086a685a1716f58
SHA256

27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d
SHA512

06469650b985a9957cbb3ae6f49422c9a54b610bb2593794223a525bac6e3ee74e898b314113c24e1839d7d749dfb5047ca5de57f5ba35f91fd94a218bf89668
SSDEEP

196608:LcnKASm9cemXyuSyTde8zveNK+wfm/pf+xfdkRKxKEr2WOHWKD39eH7:KSm/tByxjgK+9/pWFGRK0Er2W673MH

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2900	27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195a8-46.dat	upx
behavioral1/memory/2900-48-0x000007FEF5CB0000-0x000007FEF6298000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2900	3048	27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe	30
PID 3048 wrote to memory of 2900	3048	27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe	30
PID 3048 wrote to memory of 2900	3048	27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe	30

C:\Users\Admin\AppData\Local\Temp\27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe
"C:\Users\Admin\AppData\Local\Temp\27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe
  "C:\Users\Admin\AppData\Local\Temp\27450801afc63f56296f01c911375f6d216f1a100f4075c45cba369c834a413d.exe"
  2⤵
  - Loads dropped DLL
  PID:2900

C:\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
memory/2900-48-0x000007FEF5CB0000-0x000007FEF6298000-memory.dmp

Filesize
5.9MB

Download